CVE-2026-92082: Payara Server

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see  https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .

Affected products

• Payara Payara Server: from 7.0.0, before 7.2.0 (fixed in 7.2.0); from 7.2025.1, before 7.2026.7 (fixed in 7.2026.7); from 6.0.0, before 6.40.0 (fixed in 6.40.0); from 5.20.0, before 5.89.0 (fixed in 5.89.0); from 4.1.144, before 4.1.2.191.57 (fixed in 4.1.2.191.57); version 6.2023.1 only; …

Published 2026-09-15. Last modified 2026-09-18.